CVE-2026-49272

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validatetokenrequest to check that the devicecode parameter is present and valid. A caller whose client request is accepte...

ROOT-APP-PYPI-CVE-2026-118669 CVE-2026-118669 in oauthlib - Patched by Root

Root has patched CVE-2026-118669 in the oauthlib package for Root:PyPI. Multiple fixed versions available...

CVE-2026-49272

A flaw was found in OAuthLib. This vulnerability allows a remote attacker to bypass authentication and obtain unauthorized access tokens during the device authorization workflow. By submitting a token request with a valid client identifier alongside an invalid or missing device authorization code...

UBUNTU-CVE-2026-49272

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validatetokenrequest to check that the devicecode parameter is present and valid. A caller whose client request is accepte...

CVE-2026-49272

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validatetokenrequest to check that the devicecode parameter is present and valid. A caller whose client request is accepte...

CVE-2026-49272 OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validatetokenrequest to check that the devicecode parameter is present and valid. A caller whose client request is accepte...

CVE-2026-49272

The OAuthLib library (Python 3.6+) contains a vulnerability in its RFC 8628 device workflow affecting versions 3.3.0 through 4.0.1 . The root cause is that the DeviceCodeGrant.validate_token_request method fails to verify that the device_code parameter is present and valid. Consequently, an attac...

CVE-2026-49272 OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.3.0 until 4.0.1, OAuthLib's RFC 8628 device workflow does not require DeviceCodeGrant.validatetokenrequest to check that the devicecode parameter is present and valid. A caller whose client request is accepte...

ROOT-APP-PYPI-CVE-2026-49272 CVE-2026-49272 in oauthlib - Patched by Root

Root has patched CVE-2026-49272 in the oauthlib package for Root:PyPI. Multiple fixed versions available...

bootstrap4-cdn (>=4.0.1, <=4.0.7), c7n-azure (>=0.7.18, <=0.7.19) +29 more potentially affected by CVE-2026-118669 via oauthlib (3.2.1)

oauthlib PYPI version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on oauthlib and may be impacted: - bootstrap4-cdn =4.0.1, =0.7.18, =0.2.18, =1.3.2, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =1.1.0, =0.1.1, =0.2.561, =0.1.22, =1.0.24 and more Source cves...

bkkcsirip (>=1.0.0, <=1.1.0), django-oauth-toolkit (0.11.0) +3 more potentially affected by CVE-2026-118669 via oauthlib (1.1.2)

oauthlib PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on oauthlib and may be impacted: - bkkcsirip =1.0.0, =0.3.0, =1.0.0a10, =1.0.0b2 - oauthlib-extras 1.0.0 Source cves: CVE-2026-118669 Source advisory: OSV:GHSA-7984-QGVG-3J9C...

bitbucket-linter (>=0.0.3, <=0.0.10) potentially affected by CVE-2026-118669 via oauthlib (1.0.3)

oauthlib PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on oauthlib and may be impacted: - bitbucket-linter =0.0.3, =0.0.10 Source cves: CVE-2026-118669 Source advisory: OSV:GHSA-7984-QGVG-3J9C...

GHSA-7984-QGVG-3J9C OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

Summary OAuthlib's token grant handlers can authenticate one client while authorizing the grant type and requested scopes using a different, attacker-supplied clientid from the request body. In affected token grant flows, authenticateclientrequest sets request.client to the authenticated client...

microsofthealth (0.1.0), underarmour (0.1.2) potentially affected by CVE-2026-118669 via oauthlib (2.0.0)

oauthlib PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthlib and may be impacted: - microsofthealth 0.1.0 - underarmour 0.1.2 Source cves: CVE-2026-118669 Source advisory: OSV:GHSA-7984-QGVG-3J9C...

mendeley (>=0.2.3, <=0.2.4), pokitdok (>=1.1.0, <=2.7.1) potentially affected by CVE-2026-118669 via oauthlib (0.6.3)

oauthlib PYPI version 0.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on oauthlib and may be impacted: - mendeley =0.2.3, =1.1.0, =2.7.1 Source cves: CVE-2026-118669 Source advisory: OSV:GHSA-7984-QGVG-3J9C...

calibration-client (6.1.3), ctodd-python-lib-email (>=1.0.0, <=1.0.1) +3 more potentially affected by CVE-2026-118669 via oauthlib (3.0.2)

oauthlib PYPI version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on oauthlib and may be impacted: - calibration-client 6.1.3 - ctodd-python-lib-email =1.0.0, =3.0.2, =3.0.5 - oauth2-xfel-client 5.1.1 Source cves: CVE-2026-118669 Source advisory...

devilry (>=6.0.0rc1, <=6.3.1), discord-curious (>=0.7.0, <=0.7.9) +1 more potentially affected by CVE-2026-118669 via oauthlib (2.0.7)

oauthlib PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on oauthlib and may be impacted: - devilry =6.0.0rc1, =0.7.0, =1.1.0, =2.0.0 Source cves: CVE-2026-118669 Source advisory: OSV:GHSA-7984-QGVG-3J9C...

async-patterns (0.2.0), discord-curious (>=0.5.0, <=0.6.0) +1 more potentially affected by CVE-2026-118669 via oauthlib (2.0.2)

oauthlib PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on oauthlib and may be impacted: - async-patterns 0.2.0 - discord-curious =0.5.0, =0.1.0a88, =0.1.0b19 Source cves: CVE-2026-118669 Source advisory: OSV:GHSA-7984-QGVG-3J9C...

allinsso (>=0.0.1, <=0.0.6), allinusersettings (>=0.0.1, <=0.0.3) +73 more potentially affected by CVE-2026-118669 via oauthlib (2.1.0)

oauthlib PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthlib and may be impacted: - allinsso =0.0.1, =0.0.1, =0.1.3, =1.0.0, =12.1.3, =0.1.0, =0.5.29, =2.0.2, =0.5.0, =0.6.15, =0.2.0rc0, =0.2.0, =0.1.4, =0.1.6 and more Source...

legion (>=0.10.0, <=0.11.0) potentially affected by CVE-2026-118669 via oauthlib (3.0.0)

oauthlib PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthlib and may be impacted: - legion =0.10.0, =0.11.0 Source cves: CVE-2026-118669 Source advisory: OSV:GHSA-7984-QGVG-3J9C...